Security on the internet continues to evolve, and older cryptographic protocols no longer provide the protections required for today’s threat landscape. As part of our ongoing work to help customers keep their email environments secure, we’re taking another step in modernizing Exchange Online connectivity.
What’s changing
We’re planning to fully deprecate support for legacy TLS versions (TLS 1.0 and TLS 1.1) for POP3 and IMAP4 connections to Exchange Online. These older TLS versions have been industry‑deprecated for some time and are no longer considered secure.
Modern email clients and libraries already support TLS 1.2 or higher, and the vast majority of POP and IMAP traffic to Exchange Online today uses these newer protocols.
Several years ago we started the move to block these older versions, but we did allow you to use them by opting-in, we’re now removing support for them entirely. Our expectation is that only customers who have explicitly opted into using those legacy endpoints are impacted by the deprecation we are announcing today.
What customers should do
If you’re using POP or IMAP with Exchange Online, ensure that:
- Your email clients, applications, and libraries support TLS 1.2 or later and are not using legacy endpoints to connect to our service.
- Any custom or embedded applications (such as devices or legacy services) are updated accordingly.
If you aren’t sure if you are using legacy versions, check the configuration of your POP and IMAP clients and if you are, your application or device vendor can typically confirm TLS support and provide upgrade guidance.
What’s next
We will start to block legacy version connections starting in July 2026.
As always, our goal is to make these transitions predictable and well‑communicated, while continuing to strengthen security across Microsoft 365.
The Exchange Team
